Privacy Policy

Effective date: July 1, 2026 Last updated: June 28, 2026

ChatDuel ("we," "us," or "our") operates the ChatDuel mobile application (the "App"). This Privacy Policy explains how we collect, use, store, share, and protect your personal data when you use the App.

By creating an account or using the App, you agree to the practices described in this Privacy Policy. If you do not agree, please do not use the App.

1. Who We Are

ChatDuel is developed and operated by Benjamin Kashamuka, an independent developer based in Luxembourg. For the purposes of the EU General Data Protection Regulation (GDPR), we are the data controller responsible for your personal data.

Contact: support@chatduel.app

2. Data We Collect

2.1 Account Information

When you create an account, we collect:

• Email address — used for authentication and account recovery.
• Username — your chosen display name, visible to other users.
• Password (email sign-up only) — stored securely by our authentication provider; we never have access to your plaintext password.
• Sign in with Apple identifier — if you choose to sign in with Apple, we receive a unique identifier and, if you consent, your email address. We also store an encrypted authorization token solely for the purpose of revoking your Apple credentials if you delete your account.

2.2 Profile Information

You may optionally provide:

• A profile photo (avatar).

2.3 Messages and Communications

• Text messages you send in one-on-one and group conversations.
• Media attachments (photos, videos, voice messages, files) you send in conversations.
• Social feed posts (photos, videos) you publish to the feed.

Message content is stored on our servers to deliver it to conversation participants. We do not read, scan, or analyze the content of your messages for advertising or profiling purposes.

2.4 Call Metadata

When you make or receive audio or video calls through the App, we process:

• Call initiation and participant information.
• Call duration and connection metadata.

We do not record the audio or video content of your calls.

2.5 Game and Challenge Data

• Game scores, challenge results, and related activity when you play games or participate in challenges within the App.

2.6 Subscription and Purchase Data

If you subscribe to ChatDuel Premium:

• Subscription status, product identifier, and expiration date.
• Apple transaction identifiers (used to verify your purchase with Apple and prevent duplicate claims).

We do not collect or store your payment card details. All payments are processed by Apple through the App Store.

2.7 Device and Technical Data

• Push notification tokens (APNs) — used to deliver notifications to your device.
• VoIP push tokens — used to wake the App for incoming calls.
• IP address — visible to our servers during API requests; used for connection routing and security, not for tracking or profiling.

2.8 Usage and Diagnostic Data

We use Sentry, a third-party error-monitoring service, to collect crash reports and diagnostic data. This may include device model, operating system version, and technical error details. This data is used solely to identify and fix bugs. It is not used for advertising.

3. How We Use Your Data

We use your personal data to:

• Provide and operate the App — deliver messages, connect calls, process game challenges, display your profile and feed posts to other users.
• Authenticate your identity — verify your account at sign-in and for sensitive actions like account deletion.
• Process subscriptions — verify your ChatDuel Premium subscription status with Apple.
• Send notifications — deliver push notifications for new messages, incoming calls, friend requests, and other in-app events.
• Maintain security — detect abuse, enforce rate limits, and protect the integrity of the service.
• Diagnose and fix issues — use crash reports and error logs to improve the App's reliability.
• Comply with legal obligations — respond to lawful requests and enforce our Terms of Service.

We do not use your data for targeted advertising. We do not sell your data.

4. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, we rely on the following legal bases:

• Performance of a contract — processing necessary to provide you with the App's services (messaging, calls, games, feed) under our Terms of Service.
• Legitimate interests — processing necessary for security, fraud prevention, and service improvement, where those interests are not overridden by your rights.
• Consent — where you have given specific consent, such as opting in to push notifications or choosing to sign in with Apple. You may withdraw consent at any time.
• Legal obligation — where we are required to process data to comply with applicable law.

5. How We Share Your Data

We do not sell, rent, or trade your personal data.

We share data only in the following limited circumstances:

5.1 With Other Users

Your username, avatar, messages, feed posts, game scores, and call participation are visible to other users you interact with. Group conversation members can see messages and media sent within that group.

5.2 With Service Providers

We use the following third-party services to operate the App. Each processes data on our behalf under contractual obligations to protect your data:

LiveKit is self-hosted on infrastructure we control; call media streams are relayed through our server and are not stored or recorded.

5.3 For Legal Reasons

We may disclose your data if required by law, court order, or governmental request, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

6. Data Retention

• Account data is retained for as long as your account is active.
• Messages and media are retained for as long as the conversation exists, unless you or another participant erases the conversation or clears chat history.
• Feed posts are retained until you delete them.
• Crash reports (Sentry) are retained for 90 days.
• Call metadata is transient and not stored beyond the active session.

Account Deletion

When you delete your account:

1. Your account enters a 30-day grace period during which you can sign back in and cancel the deletion.
2. After 30 days, your account is permanently and irreversibly deleted. This includes:
   • Deletion of your user record, profile photo, and uploaded media (avatars, feed posts).
   • Removal from all friend lists, subscriptions, and feed activity.
   • Reassignment of your message sender identity to an anonymous "Deleted user" placeholder so that existing conversations remain readable for other participants, but your identity is no longer associated with them.
   • If you signed in with Apple, revocation of the App's access to your Apple credentials.
   • Deletion of your authentication credentials.
3. A minimal compliance record (your username at the time of deletion, the deletion date, and completion status) is retained in an audit log that cannot be linked back to a live account.

You can request account deletion from within the App under Settings.

7. Data Security

We take the security of your data seriously and implement appropriate technical and organizational measures, including:

• Encrypted connections (TLS/HTTPS) for all data in transit between the App and our servers.
• Encrypted storage for sensitive credentials (e.g., Apple refresh tokens are AES-256-GCM encrypted at rest).
• Authentication tokens (JWT) with limited validity for API access.
• Rate limiting to prevent abuse.
• Server infrastructure deployed in the EU (Frankfurt region).

No system is perfectly secure. While we strive to protect your data, we cannot guarantee absolute security.

8. International Data Transfers

Our primary server infrastructure is hosted in the EU (Frankfurt, Germany). Some third-party service providers may process data outside the EEA. Where this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission, or reliance on adequacy decisions.

9. Your Rights (GDPR)

If you are in the EEA, UK, or Switzerland, you have the following rights regarding your personal data:

• Access — request a copy of the data we hold about you.
• Rectification — request correction of inaccurate data.
• Erasure — request deletion of your data (see Section 6 above for account deletion).
• Restriction — request that we limit processing of your data in certain circumstances.
• Portability — request your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at support@chatduel.app. We will respond within 30 days.

You also have the right to lodge a complaint with a supervisory authority. For Luxembourg residents, this is the Commission Nationale pour la Protection des Données (CNPD) at https://cnpd.public.lu.

10. Children's Privacy

The App is not directed at children under the age of 13 (or 16 in certain EEA jurisdictions). We do not knowingly collect personal data from children. If we learn that we have collected data from a child without appropriate parental consent, we will delete it promptly. If you believe a child has provided us with personal data, please contact us at support@chatduel.app.

11. Third-Party Links

The App may contain links to third-party websites or services (e.g., Apple's subscription management). We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy policies.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the App or by other appropriate means. The "Last updated" date at the top of this page indicates when the policy was last revised. Continued use of the App after changes take effect constitutes your acceptance of the revised policy.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

Email: support@chatduel.app Phone: +243 999 520 389

For GDPR-related inquiries, you may also contact the Luxembourg data protection authority (CNPD) at https://cnpd.public.lu.